4 ms·

I find the more you try to protect your identity, preserve your privacy, protect your security the less sites want you to visit. You get stuck behind CloudFlare

I find the more you try to protect your identity, preserve your privacy, protect your security the less sites want you to visit. You get stuck behind CloudFlare interactive prompts (as half the planet seems to be using CloudFlare in some way) whilst it tries to work out if you’re a bot. The other sites either assume you’re an attacker and say bye, or try and stick you in some kind of CAPTCHA tar-pit. In short the web becomes unusable the better you get at this.

frombody 5y ago
You are likely getting stuck behind Cloudflare prompts because you are attempting to 'hide your identity' via tor or VPN service. You're likely attempting to use the same channels as attackers, but want to be treated differently 'just because' Kind of hard to write rules for criteria like that.
- beermonster 5y ago
  I do not use tor or a VPN service.
azalemeth 5y ago
Indeed. This is one of the greatest (and most under-appreciated) irritations of the whole CDN revolution: if you're a site serving 1e6 (or 1e9!) people, and trying to tell humans/computers apart via statistical means, the tail of the "human/computer" distribution really matters. Most site operators also don't seem to realise that the same human appears at the outskirts of the human/computer classification each time, and therefore comes to mightily hate Cloudfare (etc). My partner uses -- for work -- a vanilla Google Chrome on Windows browsing life. I use, for work, FF on Linux, usually behind a VPN or two in a different country to where we are. I see maybe....100, maybe, 1000 times more captchas than she does? Embedded reCaptcha JS code on a page inevitably shows me fifteen pages of traffic lights and lets hers go through. Often sites geo-IP me (incorrectly) to the wrong location. It's a very far cry from the HTML 1.0 days. And nobody outside of HN even understands why this is a thing, and an annoying thing at that!
1vuio0pswjnm7 5y ago
Well, I do not send the minimum as a privacy measure. I do it for speed and efficiency. Because I am so often using netcat, tcpclient or the like to make requests, I have learnt that most headers browsers send are totally unnecessary. I have had the opposite experience to what you describe. The web is really fast. Cloudflare especially. They offer ESNI, which I do use for privacy. No point in encrypting DNS if we ignore SNI. I make all requests to Cloudflare using an ESNI-enabled openssl as a backend for the forward proxy. Very rare to encounter the CAPTCHA. I am more annoyed by AWS who require SNI but offer no ESNI service. Honestly, to me the web feels unusable if I try to use a "modern" graphical browser with Javascript and a DNS resolver enabled. The way most people use the web, I guess. To me it feels like a tar-pit. I do some basic stuff like banking, etc. that way, but for recreational use, I do not use the major browsers.
- beermonster 5y ago
  The problem I descibe is that barriers get in the way the more you try and protect your privacy or security. It's not a speed issue - the web works very fast with me using NoScript and uBlock Origin. It's just lots of sites now longer like you visting or treat you as an attacker - you're soft blocked. If you ramp it up, even more of the web becomes a pain to use: e.g. using privoxy/polipo/squid, pi-holes, vpns etc, removing or changing headers, screen sizes and geolocation, timezone etc etc to make you less fingerprintable. Of course all you're really doing now is making yourself stand out like a sore-thumb. The web is even faster when I'm using telnet/openssl s_client -connect, but that's not the point is it or even a fair comparison? I just want to browse the web without being tracked and categorised/labelled. It seems that's too much to ask. Regarding CDN/Caching: Google made a change[1] to how caching works which also has some CDN impact. Instead of saving a resource with its full URL only, they have added two more bits of data to the saved information. Chrome saves the top-level site and the current-frame site next to the full URL of the cached resource. The browser uses the information to determine whether it should serve resources from the cache or not. [1] https://developers.google.com/web/updates/2020/10/http-cache-partitioning https://developers.google.com/web/updates/2020/10/http-cache...
  - deleted 5y ago

frombody 5y ago

You are likely getting stuck behind Cloudflare prompts because you are attempting to 'hide your identity' via tor or VPN service. You're likely attempting to use the same channels as attackers, but want to be treated differently 'just because' Kind of hard to write rules for criteria like that.

beermonster 5y ago
I do not use tor or a VPN service.

azalemeth 5y ago

Indeed. This is one of the greatest (and most under-appreciated) irritations of the whole CDN revolution: if you're a site serving 1e6 (or 1e9!) people, and trying to tell humans/computers apart via statistical means, the tail of the "human/computer" distribution really matters. Most site operators also don't seem to realise that the same human appears at the outskirts of the human/computer classification each time, and therefore comes to mightily hate Cloudfare (etc). My partner uses -- for work -- a vanilla Google Chrome on Windows browsing life. I use, for work, FF on Linux, usually behind a VPN or two in a different country to where we are. I see maybe....100, maybe, 1000 times more captchas than she does? Embedded reCaptcha JS code on a page inevitably shows me fifteen pages of traffic lights and lets hers go through. Often sites geo-IP me (incorrectly) to the wrong location. It's a very far cry from the HTML 1.0 days. And nobody outside of HN even understands why this is a thing, and an annoying thing at that!

1vuio0pswjnm7 5y ago

Well, I do not send the minimum as a privacy measure. I do it for speed and efficiency. Because I am so often using netcat, tcpclient or the like to make requests, I have learnt that most headers browsers send are totally unnecessary. I have had the opposite experience to what you describe. The web is really fast. Cloudflare especially. They offer ESNI, which I do use for privacy. No point in encrypting DNS if we ignore SNI. I make all requests to Cloudflare using an ESNI-enabled openssl as a backend for the forward proxy. Very rare to encounter the CAPTCHA. I am more annoyed by AWS who require SNI but offer no ESNI service. Honestly, to me the web feels unusable if I try to use a "modern" graphical browser with Javascript and a DNS resolver enabled. The way most people use the web, I guess. To me it feels like a tar-pit. I do some basic stuff like banking, etc. that way, but for recreational use, I do not use the major browsers.

beermonster 5y ago
The problem I descibe is that barriers get in the way the more you try and protect your privacy or security. It's not a speed issue - the web works very fast with me using NoScript and uBlock Origin. It's just lots of sites now longer like you visting or treat you as an attacker - you're soft blocked. If you ramp it up, even more of the web becomes a pain to use: e.g. using privoxy/polipo/squid, pi-holes, vpns etc, removing or changing headers, screen sizes and geolocation, timezone etc etc to make you less fingerprintable. Of course all you're really doing now is making yourself stand out like a sore-thumb. The web is even faster when I'm using telnet/openssl s_client -connect, but that's not the point is it or even a fair comparison? I just want to browse the web without being tracked and categorised/labelled. It seems that's too much to ask. Regarding CDN/Caching: Google made a change[1] to how caching works which also has some CDN impact. Instead of saving a resource with its full URL only, they have added two more bits of data to the saved information. Chrome saves the top-level site and the current-frame site next to the full URL of the cached resource. The browser uses the information to determine whether it should serve resources from the cache or not. [1] https://developers.google.com/web/updates/2020/10/http-cache-partitioning https://developers.google.com/web/updates/2020/10/http-cache...
- deleted 5y ago